Skip to content

fix(zoo-gateway): stop unauthenticated model discovery 401 spam #490

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JamesRobert20 merged 3 commits into from
Jun 5, 2026
Merged

fix(zoo-gateway): stop unauthenticated model discovery 401 spam #490

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
06634f0
fix(zoo-gateway): stop unauthenticated model discovery 401 spam
JamesRobert20 Jun 5, 2026
e1d8860
test(zoo-gateway): cover useZooGatewayRouterModelsSync hook
JamesRobert20 Jun 5, 2026
e7d6903
test(zoo-gateway): assert full cache survives empty model response
JamesRobert20 Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions packages/types/src/vscode-extension-host.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ export interface ExtensionMessage {
| "commitSearchResults"
| "listApiConfig"
| "routerModels"
| "zooGatewayCredentialsReady"
| "openAiModels"
| "ollamaModels"
| "lmStudioModels"
Expand Down
10 changes: 4 additions & 6 deletions src/api/providers/fetchers/__tests__/zoo-gateway.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,13 +77,11 @@ describe("Zoo Gateway Fetchers", () => {
expect(models["anthropic/claude-sonnet-4"]).toBeDefined()
})

it("omits the Authorization header when no token is provided", async () => {
mockedAxios.get.mockResolvedValueOnce(mockResponse)

await getZooGatewayModels({ zooGatewayBaseUrl: baseUrl } as any)
it("skips the request and returns {} when no token is available", async () => {
const models = await getZooGatewayModels({ zooGatewayBaseUrl: baseUrl } as any)

const call = mockedAxios.get.mock.calls[0]
expect(call[1].headers.Authorization).toBeUndefined()
expect(mockedAxios.get).not.toHaveBeenCalled()
expect(models).toEqual({})
})

it("returns {} and never leaks the error object when the request fails", async () => {
Expand Down
9 changes: 6 additions & 3 deletions src/api/providers/fetchers/zoo-gateway.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,12 @@ export async function getZooGatewayModels(options?: ApiHandlerOptions): Promise<
const baseURL = options?.zooGatewayBaseUrl ?? `${getZooCodeBaseUrl()}/api/gateway/v1`

const sessionToken = resolveZooGatewaySessionToken(options?.zooSessionToken)
const headers: Record<string, string> = {}
if (sessionToken) {
headers["Authorization"] = `Bearer ${sessionToken}`
if (!sessionToken) {
return models
}

const headers: Record<string, string> = {
Authorization: `Bearer ${sessionToken}`,
}

try {
Expand Down
5 changes: 4 additions & 1 deletion src/core/webview/ClineProvider.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -943,7 +943,8 @@ export class ClineProvider
}

if (allUpToDate) {
// All profiles have the current token — nothing to do
const { postZooGatewayCredentialsReady } = await import("../../services/zoo-gateway-credentials-sync")
postZooGatewayCredentialsReady((message) => this.postMessageToWebview(message))
return
}
}
Expand Down Expand Up @@ -1815,6 +1816,8 @@ export class ClineProvider
)
}
await this.postStateToWebview()
const { postZooGatewayCredentialsReady } = await import("../../services/zoo-gateway-credentials-sync")
postZooGatewayCredentialsReady((message) => this.postMessageToWebview(message))
}

// Requesty
Expand Down
4 changes: 4 additions & 0 deletions src/core/webview/__tests__/ClineProvider.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3707,12 +3707,14 @@ describe("ClineProvider - Comprehensive Edit/Delete Edge Cases", () => {
} as any)
const upsertSpy = vi.spyOn(provider, "upsertProviderProfile").mockResolvedValue("profile-id")
vi.spyOn(provider, "postStateToWebview").mockResolvedValue(undefined)
const postMessageSpy = vi.spyOn(provider, "postMessageToWebview").mockResolvedValue(undefined)
;(provider as any).providerSettingsManager = {
listConfig: vi.fn().mockResolvedValue([]),
}

await provider.handleZooCodeCallback("zoo_ext_token")

expect(postMessageSpy).toHaveBeenCalledWith({ type: "zooGatewayCredentialsReady" })
expect(upsertSpy).toHaveBeenCalledWith(
"Zoo Gateway",
expect.objectContaining({
Expand Down Expand Up @@ -3809,6 +3811,7 @@ describe("ClineProvider - Comprehensive Edit/Delete Edge Cases", () => {
const { getCachedZooCodeToken } = await import("../../../services/zoo-code-auth")
vi.mocked(getCachedZooCodeToken).mockReturnValue("current-token")
const handleSpy = vi.spyOn(provider, "handleZooCodeCallback").mockResolvedValue(undefined)
const postMessageSpy = vi.spyOn(provider, "postMessageToWebview").mockResolvedValue(undefined)

;(provider as any).providerSettingsManager = {
listConfig: vi.fn().mockResolvedValue([{ name: "Zoo Gateway", apiProvider: "zoo-gateway" }]),
Expand All @@ -3821,6 +3824,7 @@ describe("ClineProvider - Comprehensive Edit/Delete Edge Cases", () => {
await (provider as any).ensureZooGatewayProfileSeeded()

expect(handleSpy).not.toHaveBeenCalled()
expect(postMessageSpy).toHaveBeenCalledWith({ type: "zooGatewayCredentialsReady" })
})

it("re-seeds when any zoo-gateway profile has a stale or missing token", async () => {
Expand Down
1 change: 1 addition & 0 deletions src/core/webview/webviewMessageHandler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -981,6 +981,7 @@ export const webviewMessageHandler = async (
key: "zoo-gateway",
options: {
provider: "zoo-gateway",
apiKey: apiConfiguration.zooSessionToken,
baseUrl: apiConfiguration.zooGatewayBaseUrl,
},
},
Expand Down
6 changes: 6 additions & 0 deletions src/services/zoo-gateway-credentials-sync.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
import type { ExtensionMessage } from "@roo-code/types"

/** Notifies the webview that Zoo Gateway credentials are available for model discovery. */
export function postZooGatewayCredentialsReady(postMessage: (message: ExtensionMessage) => void): void {
postMessage({ type: "zooGatewayCredentialsReady" })
}
2 changes: 2 additions & 0 deletions webview-ui/src/components/settings/ApiOptions.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import { vscode } from "@src/utils/vscode"
import { validateApiConfigurationExcludingModelErrors, getModelValidationError } from "@src/utils/validate"
import { useAppTranslation } from "@src/i18n/TranslationContext"
import { useRouterModels } from "@src/components/ui/hooks/useRouterModels"
import { useZooGatewayRouterModelsSync } from "@src/components/ui/hooks/useZooGatewayRouterModelsSync"
import { useSelectedModel } from "@src/components/ui/hooks/useSelectedModel"
import { requestLmStudioModels } from "@src/components/ui/hooks/useLmStudioModels"
import { useExtensionState } from "@src/context/ExtensionStateContext"
Expand Down Expand Up @@ -171,6 +172,7 @@ const ApiOptions = ({
typeof apiConfiguration.apiProvider === "string" && isRetiredProvider(apiConfiguration.apiProvider)

const { data: routerModels, refetch: refetchRouterModels } = useRouterModels()
useZooGatewayRouterModelsSync()

const { data: openRouterModelProviders } = useOpenRouterModelProviders(
apiConfiguration?.openRouterModelId,
Expand Down
4 changes: 2 additions & 2 deletions webview-ui/src/components/ui/hooks/useRouterModels.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ type UseRouterModelsOptions = {
enabled?: boolean // gate fetching entirely
}

const getRouterModels = async (provider?: string) =>
export const fetchRouterModels = async (provider?: string) =>
new Promise<RouterModels>((resolve, reject) => {
const cleanup = () => {
if (typeof window !== "undefined") {
Expand Down Expand Up @@ -57,7 +57,7 @@ export const useRouterModels = (opts: UseRouterModelsOptions = {}) => {
const provider = opts.provider || undefined
return useQuery({
queryKey: ["routerModels", provider || "all"],
queryFn: () => getRouterModels(provider),
queryFn: () => fetchRouterModels(provider),
enabled: opts.enabled !== false,
})
}
59 changes: 59 additions & 0 deletions webview-ui/src/components/ui/hooks/useZooGatewayRouterModelsSync.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
import { useCallback, useEffect, useRef } from "react"
import { useQueryClient } from "@tanstack/react-query"

import type { ExtensionMessage, RouterModels } from "@roo-code/types"

import { useExtensionState } from "@src/context/ExtensionStateContext"

import { fetchRouterModels } from "./useRouterModels"

/**
* Keeps zoo-gateway models in the shared routerModels query fresh when credentials
* become available (sign-in or profile seeding) without coupling auth to modelCache.
*/
export function useZooGatewayRouterModelsSync() {
const queryClient = useQueryClient()
const { zooCodeIsAuthenticated } = useExtensionState()
const wasAuthenticatedRef = useRef<boolean | undefined>(undefined)

const syncZooGatewayModels = useCallback(async () => {
if (!zooCodeIsAuthenticated) {
return
}

try {
const partial = await fetchRouterModels("zoo-gateway")
const zooModels = partial["zoo-gateway"]
if (!zooModels || Object.keys(zooModels).length === 0) {
return
}

queryClient.setQueryData<RouterModels>(["routerModels", "all"], (current) =>
current ? { ...current, "zoo-gateway": zooModels } : partial,
)
} catch {
// Ignore: bulk router fetch may still be in flight.
}
}, [queryClient, zooCodeIsAuthenticated])

useEffect(() => {
const onMessage = (event: MessageEvent) => {
const message = event.data as ExtensionMessage
if (message.type === "zooGatewayCredentialsReady") {
void syncZooGatewayModels()
}
}

window.addEventListener("message", onMessage)
return () => window.removeEventListener("message", onMessage)
}, [syncZooGatewayModels])

useEffect(() => {
const wasAuthenticated = wasAuthenticatedRef.current
wasAuthenticatedRef.current = zooCodeIsAuthenticated

if (zooCodeIsAuthenticated && wasAuthenticated === false) {
void syncZooGatewayModels()
}
}, [zooCodeIsAuthenticated, syncZooGatewayModels])
}
Comment on lines +14 to +59

@coderabbitai coderabbitai Bot Jun 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major | ⚡ Quick win

Add test coverage for the new hook.

Per coding guidelines, hooks in webview-ui/src/**/*.{ts,tsx} should have Vitest coverage under webview-ui/src/**/__tests__. This hook has several testable behaviors:

  • Skipping sync when zooCodeIsAuthenticated is false
  • Triggering sync on "zooGatewayCredentialsReady" message when authenticated
  • Triggering sync on authentication state transition (false → true only)
  • Cache merge logic preserving existing providers
  • Graceful error handling

As per coding guidelines: "Prefer local webview-ui tests for React/webview behavior such as component rendering, local state, hooks, form dirty-state, validation, or prop wiring. Add or update Vitest coverage under webview-ui/src/**/__tests__."

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@webview-ui/src/components/ui/hooks/useZooGatewayRouterModelsSync.ts` around
lines 14 - 59, Add Vitest unit tests for the hook useZooGatewayRouterModelsSync:
write tests under webview-ui/src/**/__tests__ that mount a component using
useZooGatewayRouterModelsSync and assert the following behaviors—(1) when
zooCodeIsAuthenticated is false, syncZooGatewayModels is not called (skip sync),
(2) when a window "message" event with type "zooGatewayCredentialsReady" is
posted and zooCodeIsAuthenticated is true, syncZooGatewayModels runs, (3) when
zooCodeIsAuthenticated transitions from false to true, syncZooGatewayModels runs
only on that transition, (4) verify queryClient.setQueryData merging logic in
syncZooGatewayModels preserves existing providers (call fetchRouterModels mocked
to return partial and assert resulting ["routerModels","all"] data), and (5)
ensure errors thrown by fetchRouterModels are swallowed (mock fetchRouterModels
to throw and assert no exception bubbles and behavior continues); target
functions/symbols: useZooGatewayRouterModelsSync, syncZooGatewayModels,
fetchRouterModels, and queryClient.setQueryData, and use Vitest + React Testing
Library patterns for hooking and mocking
window.postMessage/window.addEventListener.

8 changes: 7 additions & 1 deletion webview-ui/src/context/ExtensionStateContext.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,7 +414,13 @@ export const ExtensionStateContextProvider: React.FC<{ children: React.ReactNode
break
}
case "routerModels": {
setExtensionRouterModels(message.routerModels)
const provider = message.values?.provider as string | undefined
const incoming = message.routerModels
if (provider && incoming) {
setExtensionRouterModels((current) => (current ? { ...current, ...incoming } : incoming))
} else {
setExtensionRouterModels(incoming)
}
break
}
case "marketplaceData": {
Expand Down
Loading